Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Indicting Chinese Military Officers Is A Huge Mistake
Newest First  |  Oldest First  |  Threaded View
RyanSepe
RyanSepe,
 User Rank: Ninja
5/30/2014 | 11:40:48 AM
Re: Following orders is often criminalized
This was a very well thought out and articulated response. I agree with most of the points you propose however I think some need to be analyzed.

Equating tortue and genocide to cyber espionage is not equatable on any scale. Following orders is tricky but I believe there is a fine line between the above concepts where a person of good conscience would say that I am willing to perform cyber espionage if that is my job backed by my country over killing and torturing human beings.

There is a moral boundary that is crossed with cyber espionage, however the boundaries may be initialized differently within different environments. Prime example between Chinese and US laws. Meaning that a person could have developed a code of ethics that allows them to perform things differently in China that growing up in the US may not have allowed and vice-versa. If there isn't an overall universal standard, it is hard to enforce such laws on a grand scale.
anon3493590510
anon3493590510,
 User Rank: Apprentice
5/29/2014 | 10:48:54 PM
Following orders is often criminalized
On first reading the position offered in this post seems reasonable and well-founded. But it comes up short in important ways.

The idea that soldiers, following orders that are for them lawful, are immune to criminal sanction by other nations is just wrong. On the contrary, the principle of "comity" which fathers State Immunity laws in most nations makes legal recourse against foreign governments completely unattainable in the circumstances in question. This leaves only recourse against the individuals who actually commit the criminal acts.

Moreover there is an extensive and growing body of international law, certainly post-Nuremberg, that clearly makes individuals accountable for their actions, even under orders that are for them lawful. It is a matter of degree and legal evolution to consider hwo far those laws should reach. The reach may have started at genocide but it has moved beyond that to isolated incidents of torture.

I recognize that there is a vast degree of normative difference between torture and large scale commercial theft. But it is correct to recognize that it is in fact a matter of degree, not principle. The principle has long been breached.

One of the most important reasons for criminalizing the behaviour of individuals under orders of a nation state is to create deterence to the greatest effect possible.

If it is countered that in some or even many cricumstances the criminal actors have no choice, there are well-established defences of coersion and necessity. So the existence of an objective threat is not sufficient cause to abandon the law.

The irony, or perhaps hypocrisy is more accurate, in this case is that the nation state that has been the most obstructive of criminalizing individual behaviour under orders, specifically criminalizing torture, has been the United States.

The U.S. refuses to ratify and will not recognize the authority of the Internaional Crimnal Court to even hear cases of torture, much less cases of theft of intellectual property or commercial espionage.

The U.S. position is precisely that individuals under lawful orders of another nation are subject to prosecution by the United States at the will of the United States, but no one else is competent to prosecute anyone other than their own citizens. That "exceptionalism" does pose a real long term threat to U.S. interests because depriving an indepdent international tribunal of jurisdiction means that offended or hostile foreign governments have the moral foundation laid by the U.S. upon which to build their own national prosecutions of U.S. citizens.

So, while I agree with that particular conclusion I do not accept the proposition that the international community must or should be incapacitated in prosecuting international scale crimes, including commercial espionage. Whether those crimes are prosecuted at an international court or through enabling legislation by national courts, there is no longer a good case that they should go unprosecuted. This already happens with international commercial law, which is enforced by national courts of the nations that are party to, for example trade agreements.

The Snowden distraction actually makes the case for new international norms such as an agreement not to spy on one another's leaders.

Two factual points: what are the sources for the assertion that various Western governments engage in commercial espionage for the private gain of non-government entities? And, while it may or may not be true that the direct frutis of U.S. espionage are not provided for private gain, it is not true that the U.S. does not conduct espionage for commercial purposes. It engages in active spying as part of its trade negotiations and disputes and renders heroic efforts on behalf of relatively small groups of companies such as the pharmaceutical and pesticide companies. No one of them may be given specific intellectual property, but the entire international system is moved to their private advantage, in part with the use of espionage against friendly governments.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-2339
PUBLISHED: 2022-07-07
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.
CVE-2022-20752
PUBLISHED: 2022-07-06
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This vulnerability is due to insufficient pro...
CVE-2022-20768
PUBLISHED: 2022-07-06
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of certain unencrypted credentials....
CVE-2022-20791
PUBLISHED: 2022-07-06
A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an auth...
CVE-2022-20800
PUBLISHED: 2022-07-06
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity ...